Vulnerability · Published Jun 12, 2026 · Assigned by VulnCheck

CVE-2026-53982Cap-go Console < 12.28.2 Account Deletion DoS via Device Identifier Association

Medium 6.5

In plain English

A medium-severity security flaw in capgo from Cap-go. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 73.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cap-go Console < 12.28.2 contains a denial-of-service vulnerability in its account deletion flow that allows an attacker to block authentication and onboarding functions by triggering account deletion while a device identifier is linked to the active session. The platform incorrectly associates the deletion state with the device identifier, causing the affected device or browser environment to be redirected to an account-disabled page for approximately 30 days, preventing any account login or registration from that device.

Affected products (as reported)

Vendor	Product	Versions
Cap-go	capgo	0 – before 12.28.2

Weakness: CWE-645 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-qmrm-qgwr-55jf vendor-advisory
https://github.com/Cap-go/capgo/commit/6685e5f11adef257bf3d085e481f4d8ebcec602e patch
https://www.vulncheck.com/advisories/capgo-console-account-deletion-dos-via-device-identifier-association third-party-advisory